GSM phone security

Hi

 

I am currently doing some research into GSM phone security. At the moment i am looking into threats and attacks that might be posed to GSM phones, in addition looking at other more general cyber threats.  i was wondering if someone knows if it is possible for an individual to upload spyware / malware to a VPN and have it work without being discovered. also if anyone has any knowledge into GSM phones experiencing eavesdropping.

 

all help appreciated